Centralized management of quality of service (QoS) information for data flows

ABSTRACT

Techniques are described for centralized management of quality of service (QoS) characteristics of network data flows. A service management system maintains a database that associates access information, such as a username and password, with QoS information. A router or other network device associates a data flow with access information, and queries the service management system with the access information to obtain the QoS information. The router forwards data of the data flow in accordance with the QoS information obtained from the service management system. As the access information may be a username and password, an existing system, such as a Remote Authentication Dial-In User Service (RADIUS) system, may easily be adapted for use as the service management system. As a result, QoS information may easily be centrally managed for numerous routers or other network devices.

This application is a continuation of U.S. application Ser. No.12/195,808, filed Aug. 21, 2008, now U.S. Pat. No. 7,747,728, which is acontinuation of U.S. application Ser. No. 10/459,824, filed Jun. 12,2003, now U.S. Pat. No. 7,421,487, the entire contents of each of whichare incorporated herein by reference.

TECHNICAL FIELD

The invention relates to computer networks and, more particularly, tomanaging quality of service (QoS) information for data flows.

BACKGROUND

A computer network is a collection of interconnected computing devicesthat exchange data and share resources. In a packet-based network, suchas the Internet, the computing devices communicate data by dividing thedata into small blocks called packets. The packets are individuallyrouted across the network from a source device to a destination device.The destination device extracts the data from the packets and assemblesthe data into its original form. Dividing the data into packets enablesthe source device to resend only those individual packets that may belost during transmission.

Certain devices within the network, referred to as routers, maintainrouting information that describes available routes through the network.Each route defines a path between two locations on the network. Uponreceiving an incoming data packet, a router examines header informationwithin the packet to identify the destination for the packet. Based onthe header information, the router accesses the routing information,selects an appropriate route for the packet, and forwards the packetaccordingly.

Virtual private networks (VPNs) are often used to securely share dataover public network infrastructure, such as the Internet. For example,an enterprise that includes multiple geographically separated sites,each site including one or more computing devices, may establish a VPNto allow the computing devices to securely communicate through theInternet or other public network infrastructure.

In many situations, it is desirable to control the “Quality of Service”(QoS) that a router or other network device provides to a route or othernetwork data flow associated with the VPN. In general, QoS refers to alevel of communication throughput for the data flow, and typicallyspecifies a defined bandwidth allocation and burst size. In order tocontrol the QoS provided to a VPN route, the routers establishing theVPN often need to be manually configured. This process may be timeconsuming, and may require significant manual labor.

SUMMARY

In general, the invention is directed to techniques for centralizedmanagement of quality of service (QoS) information for network dataflows. More specifically, a service management system maintains adatabase that associates access information, such as a username andpassword, with QoS information. When receiving routing informationdefining a new data flow, a router or other network device compares therouting information with selection criteria to associate the new dataflow with a service profile identifier. The router may, for example,associate a service profile identifier, such as a service profile nameor identification number, with the data flow based on the comparison.Based on the identifier, the router selects access information, such asa username and a password, queries the service management system toobtain QoS information for the new data flow.

The service management system authenticates the query from the routerand provides the router with the QoS information corresponding to theservice profile identifier and the access information associated withthe data flow. As the access information may be a username and password,an existing system, such as a Remote Authentication Dial-In User Service(RADIUS) system, may easily be adapted for use as the service managementsystem. As a result, QoS information may easily be centrally managed fornumerous routers or other network devices.

The QoS information maintained by the service management system mayinclude, for example, parameters for controlling an interface of therouter, such as a dedicated bandwidth, latency, and error rate for thedata flow. Upon receiving the QoS characteristics, the router forwardsdata of the data flow in accordance with the QoS information obtainedfrom the service management system.

In some embodiments, the router may dynamically instantiate interfacesin accordance with the interface parameters obtained from the query toservice management system. As a result, the techniques may be used toeasily control the QoS characteristics of data flows that tend to be“dynamic”, such as virtual private networks (VPN) routes, Multi-protocolLabel Switching (MPLS) paths, IPsec tunnels, and the like.

In one embodiment, a method comprises maintaining, within a router, adata structure that associates routes through a network with accessinformation for retrieving interface parameters from an external servicemanagement system. The method also includes receiving, with the router,a routing protocol packet from a second router, wherein the routingprotocol packet includes routing information that specifies at least oneroute through the network and selecting, from the data structure, theaccess information associated with the route specified by the routinginformation. The method also includes querying the external servicemanagement system with the selected access information to obtaininterface parameters for instantiating an interface and instantiating atleast one interface within the router based on the interface parametersobtained from the external service management system. The method alsoincludes forwarding data of a data flow associated with the routespecified by the routing information with the at least one interface ofthe router that was instantiated using the interface parameters obtainedfrom the external service management system.

In another embodiment, a network device comprises a control unit thatmaintains a data structure that associates routes through a network withaccess information for retrieving interface parameters from an externalservice management system. The control unit of the network devicereceives a routing protocol packet from a second router that includesrouting information that specifies at least one route through thenetwork, selects the access information associated with the routespecified by the routing information, and queries the external servicemanagement system with the selected access information to obtaininterface parameters for instantiating an interface. The network devicealso includes an interface through which the control unit forwards dataof a data flow associated with the route specified in the routinginformation, wherein the interface is configured based on the interfaceparameters obtained from the external service management system.

The invention may provide one or more advantages. For example, thetechniques allow routers or other network devices to dynamically obtainQoS information, including interface configuration characteristics, froma centralized location, e.g., a central database maintained by a RADIUSserver. As a result, the techniques may achieve reduced administrativeresources that otherwise would be necessary to manually configureinterface configuration characteristics within the routers. Furthermore,the techniques provide for the central management of QoS characteristicsof dynamic data flows, such as virtual private networks (VPN) routes,Multi-protocol Label Switching (MPLS) paths, IPsec tunnels, and thelike.

The details of one or more embodiments of the invention are set forth inthe accompanying drawings and the description below. Other features,objects, and advantages of the invention will be apparent from thedescription and drawings, and from the claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram illustrating a system in which routers query aservice management system for interface parameters in accordance withthe principles of the invention.

FIG. 2 is a block diagram illustrating an example router that queriesthe service management system of FIG. 1 to obtain interface parametersfor dynamic instantiation of interfaces.

FIG. 3 is a block diagram illustrating an example routing engine of theexample router of FIG. 2.

FIG. 4 is a flow diagram illustrating an exemplary mode of operation ofthe router of FIG. 2 when querying the service management system forinterface parameters.

DETAILED DESCRIPTION

FIG. 1 is a block diagram illustrating a system 10 in which routers 12Aand 12B (“routers 12”) query a service management system (SMS) 14 forquality of service (QoS) information in accordance with the principlesof the invention. Routers 12 may be any type of router, such as edgerouters of a public network 18, as illustrated in FIG. 1. Alternatively,routers 12 may be core routers within public network 18, a providernetwork maintained by an Internet Service Provider (ISP), or a privatenetwork. Routers 12 couple customer site networks 16A-16C (“customersite networks 16”) to public network 18. More specifically, router 12Acouples customer site network 16A to public network 18, and router 12Bcouples customer site networks 16B and 16C to public network 18. Publicnetwork 18 includes one or more autonomous systems (not shown) having anumber of devices, such as routers and switches, used to forward dataacross public network 18.

Customer site networks 16 may be geographically distributed sites of anenterprise. Each of customer site networks 16 includes one or moredevices (not shown), such as personal computers, laptop computers,handheld computers, workstations, servers, routers, switches, printers,fax machines, or the like. Customer site networks 16 may include one ormore Local Area Networks (LANs), Wide Area Network (WANs) or the like.Although system 10 may include any number of customer site networks 16coupled to public network 18 by any number of routers 12, FIG. 1, forsimplicity, shows only customer site networks 16 coupled to publicnetwork 18 by routers 12. Each of customer site networks 16 connects toa respective router 12 via one or more access links 20A-C (“access links20”).

Service management system (SMS) 14 may be a device that maintains adatabase 24 that describes QoS information for data flows through publicnetwork 18. Service management system 14 may be maintained by an ISP,and may be accessed by routers 12 via public network 18. Servicemanagement system 14 includes, for example, one or more RemoteAuthentication Dial-In User Service (RADIUS) servers that providesauthentication services and access to database 24.

Service management system 14, and more particularly database 24, storesdata that defines access information for a set of network users andassociated QoS information. Database 24 may, for example, associate ausername and password with a defined bandwidth allocation, latency, anderror rate. When receiving routing information defining data flowswithin public network 18, routers 12 compare the routing informationwith selection criteria to associate the data flows with service profileidentifiers. Based on the identifiers, routers 12 select accessinformation, and query service management system 14 to obtain QoSinformation for the data flows. In this manner, routers 12 may retrieveQoS information from a centralized location external to routers 12, andforward data flows in accordance with the retrieved QoS information. Thetechniques reduce or eliminate the need for administrators to manuallyconfigure QoS characteristics for data flows of routers 12. As a result,the techniques may avoid significant administrative resources thatotherwise would be necessary to manually maintain the QoScharacteristics of data flows through routers 12.

In the example illustrated in FIG. 1, the techniques may be used tocentrally manage the QoS characteristics of data flows associated withvirtual private network (VPN) 22. In particular, routers 12 provideservices for a virtual private network (VPN) 22. VPN 22 allows userswithin customer site networks 16 to securely communicate data flowsacross the shared public infrastructure of public network 18. Routers 12may provide subsets of users within VPN 22 with different routing andforwarding policies. Router 12A may, for example, apply a first routingand forwarding policy for data flows destined for customer site network16B, and apply a second routing and forwarding policy for data flowsdestined for customer site network 16C. The routing and forwardingpolicy applied to data flows destined for customer site network 16B maycorrespond to a QoS with a higher bandwidth allocation, reduced latency,and lower error rates than the QoS corresponding to the routing andforwarding policy applied to data flows destined for customer sitenetwork 16C.

In some embodiments, routers 12 may dynamically instantiate a logicalinterface and forward the data of the data flow via the interface. Ingeneral, a logical interface is instantiated automatically in responseto a catalyst event and in accordance with the QoS information and, morespecifically, interface parameters, received from service managementsystem 14. The catalyst event may be matching of packet information toselection criteria. For purposes of forwarding and routing, routers 12may treat the logical interfaces in a manner similar to physicalinterfaces to other network devices.

For example, in accordance with a routing protocol, router 12A mayreceive routing information that defines a data flow, such as a routewithin VPN 22. Router 12A compares routing information within the packetto selection criteria to associate a service profile identifier with theVPN route. The service profile identifier associated with the VPN routemay correspond to access information such as a user name, a password, anInternet Protocol (IP) address of selection service center 14, and thelike. Router 12A sends a query to service management system 14 thatincludes the access information corresponding to the service profileidentifier associated with the VPN route.

Service management system 14 authenticates the query and returns QoSinformation, such as interface parameters, corresponding to the dataflow. More particularly, service management system 14 compares accessinformation, for example the username and password, with entries ofdatabase 24. When the access information matches an entry of database24, service management system 14 retrieves corresponding QoSinformation, e.g., interface parameters, and relays the QoS informationto querying router 12A. Router 12A instantiates a dynamic interfacebased on the QoS information to support the VPN route. In this manner,router 12A associates QoS information, such as interface parameters,stored in a centralized location external to router 12A with thedynamically instantiated interfaces and, more particularly, the dataflows associated with the interfaces. Router 12A controls the QoS fordata flows within VPN 22 based on the dynamic interface associated withthe data flows.

In the same manner, router 12B may associate different QoScharacteristics with data flows by querying service management system14. For example, router 12B may maintain dynamic interfaces associatedwith customer site networks 16A and 16C. Router 12B may treat data flowsof the dynamic interface associated with customer site network 16A withdifferent QoS characteristics than data flows of the dynamic interfaceassociated with customer site network 16B.

As a result, routers 12 may easily provide different QoS for data flowsdestined for different users or groups of users within customer sitenetworks 16. For example, data flows of a dynamic interface associatedwith a first subset of users within customer site network 16B may havedifferent QoS characteristics than data flows of a dynamic interfaceassociated with a second subset of users within customer site network16B. Further, one of routers 12 may provide services for a plurality ofVPNs, and dynamically instantiate interfaces with different QoScharacteristics for different VPNs, each individual VPN, subsets ofusers within each VPN, or the like.

Although FIG. 1 has been described in reference to a virtual privatenetwork, the techniques of the invention may be applied to other routingconfigurations. For example, the techniques may be applied toMulti-protocol Label Switching (MPLS) paths, IPSec tunnels, and otherdata flows that may be “dynamic” in nature. As another example, routers12 may construct a plurality of data flows between one another using areservation protocol such as Resource Reservation Setup Protocol (RSVP),and associate dynamically instantiated interfaces with the data flows.As described above, the QoS provided routers 12 can easily be centrallymanaged by service management system 14 in accordance with theprinciples of the invention. Moreover, although described in referenceto a packet-based network, the techniques may be applied to a cell-basednetwork, frame-based network, or other type of network.

FIG. 2 is a block diagram illustrating an example embodiment of a router27 that may forward data of a data flow in accordance with QoSinformation obtained from a service management system, such as servicemanagement system 14 of FIG. 1. In the illustrated embodiment, router 27comprises a control unit 28 that includes a routing engine 30 and aforwarding engine 32. Router 27 further comprises one or more physicalinterface cards (IFCs) 34 that receive and send packets via networklinks 36 and 38, respectively. IFCs 34 are typically coupled to networklinks 36 and 38 via a number of interface ports.

Routing engine 30 is responsible for maintaining and updating routinginformation 40. Routing information 40 may describe a topology of anetwork, and more particularly, routes through the network. For example,routing information 40 may include, route data that describes variousroutes through the network, and also next hop data indicatingappropriate neighboring devices within the network for each of theroutes. Routing engine 30 periodically updates routing information 40 toaccurately reflect the current network topology.

Routing engine 30 analyzes its stored routing information 40 andgenerates forwarding information for use by forwarding engine 32.Forwarding engine 32 stores the forwarding information in forwardinginformation bases 44A-44N (“forwarding information bases 44”).Forwarding information bases 44 may associate, for example, networkdestinations with specific next hops and corresponding IFCs 34.Forwarding information bases 44 is, therefore, based on routinginformation 40.

Forwarding engine 32 may maintain separate forwarding information bases44 respectively associated with different VPNs as well as customer sitenetworks 16 within a particular VPN. For instance, in the example ofFIG. 1, router 27A may maintain separate forwarding information bases 44for customer site networks 16A, 16B, and 16C. Separate forwardinginformation bases 44 for different customer site networks 16 within aVPN allows control unit 28 to select an appropriate forwardinginformation base 44 via policy instead of packet information matches. Inother words, control unit 28 may select the appropriate forwardinginformation base 44 based on a mapping that maps an interface port to aforwarding information base 44. Further, separate forwarding informationbases 44 for different customer site networks 16 allows customer sitenetworks 16 associated with router 27 to use overlapping private addressspaces.

As described, router 27 queries service management system 14 for QoSinformation for forwarding data of data flows. For example, thetechniques of the invention may be used to obtain interface parametersfor dynamic instantiation of interfaces. More specifically, router 27may receive a routing protocol packet defining a new data flow, e.g., anew VPN route. Router 27 installs the VPN route into routing information40 and, in turn, into a corresponding forwarding information base 44.For example, router 27 may select a respective forwarding informationbase 44 in accordance with the interface or port on which router 27received the routing communication.

Routing engine 30 applies selection criteria to the packet to associatea service profile identifier with the VPN route. For example, routingengine 30 may apply a route map that compares packet information, suchas a Border Gateway Protocol version 4 (BGP4) extended community, withthe selection criteria. When the packet information matches theselection criteria, routing engine 30 associates a respective serviceprofile identifier, such as a service profile name or identificationnumber, with the route.

Based on the service profile identifier associated with the VPN route,routing engine 30 retrieves access information from access data 42.Access data 42 may, for example, store access information for a set ofservice profiles. For example, access data 42 may maintain accessinformation for two service profiles having service profile identifiers“Gold” and “Silver.” For each service profile, access data 42 definesrespective access information, such as a username, password, or otherauthentication information, for retrieving respective quality of serviceinformation from service management system 14. The username may, forinstance, be the same as the service profile identifier. Routing engine30 stores access data 42 as one or more data structures on one or morecomputer-readable media, such as a magnetic medium, optical medium,non-volatile random access memory (NVRAM), FLASH memory, or the like.Routing engine 30 may maintain access data 42 in the form of a varietyof data structures, such as tables, radix trees, flat files, anddatabases.

Upon retrieving the access information for the VPN route, routing engine30 uses the access information to query service management system 14.Routing engine 30 may, for example, send a query to service managementsystem 14 via a respective outbound link 38 and public network 18. Thequery to service management system 14 may include the access informationcorresponding to the service profile identifier associated with the VPNroute, e.g., the username and password from access data 42.

In response, service management system 14 authenticates the query fromrouting engine 30, and returns QoS information. The QoS information may,for example, include such as a defined bandwidth allocation, latency,error rate or the like. The QoS information may also include interfaceparameters. Routing engine 30 may dynamically instantiate a logicalinterface that corresponds to the VPN route in accordance with theinterface parameters received from service management system 14. Routingengine 30 may also update routing information 40 and, in turn, acorresponding forwarding information base 44 (FIG. 2) to associate theinstantiated logical interface with the next hop for packetscorresponding to the VPN route.

In similar fashion, routing engine 30 may dynamically instantiate otherlogical interfaces corresponding to other VPN routes in accordance withQoS information received in response to queries to service managementsystem 14. For example, routing engine 30 may instantiate a firstlogical interface that has a first set of interface parameters for dataflows of a first one of customer site networks 16, and a second logicalinterface that has a second set of interface parameters for data flowsof a second one of customer site networks 16. In this manner, routingengine 30 may provide data flows of VPN 22 with different QoScharacteristics.

Router 27 may operate according to executable instructions fetched froma computer-readable medium (not shown). Examples of such media includerandom access memory (RAM), read-only memory (ROM), non-volatile randomaccess memory (NVRAM), electrically erasable programmable read-onlymemory (EEPROM), flash memory, and the like. The functions of router 27may be implemented by executing the instructions of thecomputer-readable medium with one or more processors, discrete hardwarecircuitry, firmware, software executing on a programmable processor, ora combination of any of the above.

FIG. 3 is a block diagram illustrating an example routing engine 30 thatretrieves QoS information for data flows from a centralized location inaccordance with the principles of the invention. In the illustratedembodiment, routing engine 30 includes an operating system 50 thatprovides a multi-tasking operating environment for execution of a numberof concurrent processes 52. Examples of such an operating system areJUNOSe™ (ERX) and JUNOS™ operating systems from Juniper Networks™, Inc.of Sunnyvale, Calif. Another example of such an operating system isFreeBSD, which is an advanced UNIX operating system that is compatiblewith a number of programmable processors, including processorscommercially available from Intel Corporation™

Processes 52 include a routing protocol (RP) process 52A that includesone or more threads that implement the various network protocolssupported by routing engine 30. Routing protocol process 52A includesthreads that implement protocols for exchanging route information withother routing devices and for updating routing information 40. Routingprotocol process 52A may include, for example, threads that implementBGP, IP, RSVP, MPLS, and the like. Routing protocol process 52A may alsoinclude threads to support other protocols, such as threads thatimplement a Transmission Control Protocol/Internet Protocol (TCP/IP)network stack.

Processes 52 further include an interface creator (IC) process 52B and adynamic configuration manager (DCM) process 52C. IC process 52B receivesrequests for instantiation of one or more logical interfaces from RPprocess 52A and collects any additional information needed for theinstantiation operation. Upon obtaining all the information necessaryfor the instantiation operation, IC process 52B sends a request to DCMprocess 52C, which instantiates the respective logical interface inaccordance with the information collected by IC process 52B.

RP process 52A and IC process 52B communicate via an interprocesscommunication channel 53A. More specifically, interprocess communicationchannel 53A allows RP process 52A and IC process 52B to exchangemessages, parameter, indications and like. RP process 52A may, forexample, send a request ordering IC process 52B to instantiate aninterface instantiation operation. Likewise, IC process 52B and DCMprocess 52C communicate via interprocess communication channel 53B.

Processes 52 may also comprise a user interface (UI) process 52D thatprovides an interface by which a remote system administrator or scriptcan control and configure routing engine 30. For example, a systemadministrator may configure access data 42 via a command line interface(CLI) presented by UI process 52D.

Routing engine 30 may further comprise a network interface 54 thatprovides a hardware interface for receiving and sending packets toforwarding engine 32 (FIG. 2). Network interface 54 may comprise, forexample, a network interface card (NIC) coupled to IFCs 24 or forwardingengine 22 (FIG. 2) via link 56.

As described above, routing engine 30 queries a service managementsystem 14 for QoS information. Specifically, routing engine 30 receivesa routing protocol packet via network interface 54 and link 56. Routingengine 30 may, for example, receive a BGP packet for exchanging routinginformation among routers within a network. The BGP packet may, forinstance, define a network data flow. RP process 52A may apply a routemap to associate a service profile identifier with the data flow definedby the BGP packet. RP process 52A may, for example, apply a route mapthat compares BGP packet information, such as a BGP extended community,to selection criteria. RP process 52A associates a service profileidentifier with the data flow defined by the BGP packet based on theresults of the route map.

When the route map results in a match, RP process 52A queries servicemanagement system 14 with access information associated with thematching service profile identifier in order to obtain QoS information.In addition, RP process 52A may initiate an interface instantiationoperation. In other words, the route map applied by RP process 52A mayact as a catalyst event for dynamic instantiation of an interface.Specifically, when BGP packet information matches the selectioncriteria, i.e., the route map results in a match, RP process 52Aassociates a respective service profile identifier, such as a serviceprofile name or identification number, and, in turn, access informationwith the data flow defined by the BGP packet. RP process 52A may, forexample, retrieve access information corresponding to the serviceprofile identifier from access data 42. As described above, the accessinformation may include authentication information such as a username, apassword, a domain and the like.

RP process 52A may send a request to instantiate a logical interface toIC process 52B. RP process 52A may include the access informationcorresponding to the service profile identifier from access data 42 inthe request sent to IC process 52B. Alternatively, RP process 52A maysend a request that only includes the service profile identifier and ICprocess 52B may have to retrieve access information associated with theservice profile identifier from access data 42. The instantiationrequest may further include user-defined QoS information, e.g.,interface parameters for forwarding the data flow.

IC process 52B collects any additional information for the instantiationoperation. More specifically, IC process 52B queries a servicemanagement system 14 based on the access information. IC process 52Bmay, for example, query service management system 14 using a usernameand a password corresponding to the service profile identifierassociated with the data flow. Service management system 14authenticates the query based on the access information, e.g., usernameand password, and returns QoS information to IC process 52B based on theaccess information. In the case in which routing engine 30 instantiatesa dynamic interface for the data flow, the QoS information may includeinterface parameters. In this manner, interface parameters of numerousinterface configurations may be maintained in a centralized location,eliminating the need for administrators to manually configure interfaceparameters or other QoS for each router 12 within a network. As aresult, the techniques may avoid significant administrative resourcesthat otherwise would be necessary to manually maintain QoScharacteristics within all the routers of the network.

IC process 52B sends a request to DCM process 52C that includesinterface parameters obtained from service management system 14 alongwith any additional interface parameters specified in the instantiationrequest from RP process 52A. DCM process 52C instantiates a logicalinterface that includes all of the interface parameters indicated in therequest form IC process 52B. DCM process 52C notifies IC process 52Bupon completing the instantiation operation. IC process 52B relays theconfirmation to RP process 52A.

Although in the example of FIG. 3 routing engine 30 implements thecomparison of routing information to selection criteria, sends thequeries to service management system 14 to obtain interface parameters,and instantiates the logical interfaces in accordance with receivedinterface parameters, the tasks may be dispersed throughout thecomponents of router 12 (FIG. 2). For example, a portion of theinterface instantiation process may be implemented within forwardingengine 32 or IFCs 34. In other words, RP process 52A, IC process 52B andDCM process 52C may operate within routing engine 30, forwarding engine32, IFCs 34, or a combination thereof.

FIG. 4 is a flow diagram illustrating an exemplary mode of operation ofrouter 27 when querying service management system 14 for QoSinformation. Router 27 initially receives a routing protocol packet,such as a BGP packet, that defines a data flow within a network (58).Router 27 may, for example, receive a routing protocol packet thatdefines a new data flow within a VPN, such as VPN 22 of FIG. 1. Next,router 27 and, more particularly RP process 52A, compares information inthe routing communication with selection criteria (60). RP process 52Amay apply a route map that compares information in the routingcommunication with the selection criteria. The route map may, forexample, compare a BGP community of a BGP packet, a description of anMPLS packet, or IP addresses of an IP packet to the route map logic,i.e., the selection criteria.

When the information in the routing communication does not match theselection criteria of the route map, router 27 may not instantiate acorresponding interface, or may instantiate the interface withoutrequesting QoS information, e.g., interface parameters, from servicemanagement system 14 (62, 64). Router 27, for example, may instantiate adefault interface with no specific interface parameters, e.g., withdefault QoS characteristics. Alternatively, router 27 may instantiate aninterface with interface parameters stored in service profile data 42 orin an interface characteristic data structure maintained within router27. In either case, the interface parameters may be pre-configured,e.g., by a system administrator, for each interface and for each router.

When the information in the routing communication matches the selectioncriteria of the route map, RP process 52A associates the data flow withaccess information (62, 66). For example, when the results of the routemap indicate a match, RP process 52A may associate a service profilename or identification number and, in turn, access information for thedefined data flow. RP process 52A may further retrieve accessinformation, such as a user name and password, corresponding to theservice profile identifier from access data 42.

Next, router 27 and, more particularly, IC process 52B sends a querywith the access information to service management system 14 to retrieveinterface parameters that correspond to the service profile identifierassociated with the data flow (68). More specifically, the query mayinclude a username and password that service management system 14 willauthenticate. The access information may be communicated to IC process52B by RP process 52A via interprocess communication channel 53A.Alternatively, RP process 52A may only communicate a service profileidentifier associated with the data flow to IC process 52B, and ICprocess 52B may retrieve access information corresponding to the serviceprofile identifier from access data 42.

IC process 52B waits to receive an authentication response from servicemanagement system 14. Service management system 14 compares the accessinformation included in the query to a database 24. When the accessinformation of the query matches an entry in database 24, servicemanagement system 14 authenticates the query and sends IC process 52BQoS information, such as interface parameters, corresponding to theservice profile identifier associated with the data flow.

When IC process 52B receives a response from service management system14 denying authentication, IC process 52B notifies RP process 52A of theauthentication denial and ends the interface instantiation operation(70, 76).

When service management system 14 authenticates the query, IC process52B receives QoS corresponding to the service profile identifierassociated with the data flow (70, 72). As described above, IC process52B may receive QoS information, such as a dedicated bandwidth, latency,and error rate, and/or specific interface parameters. DCM process 52Cdynamically instantiates an interface in accordance with the interfaceparameters received from the query to service management system 14 (74).For example, DCM process 52C may receive an interface instantiationrequest from IC process 52B that includes the interface parametersreceived from the query to service management system 14, and dynamicallyinstantiate a logical interface in accordance with the interfaceparameters. In the event DCM process 52C cannot instantiate therequested interface, e.g., due to lack of required resources orincorrect parameters, DCM process 52C may return one or more error codesto IC process 52B, and the process terminates.

If the instantiation is successful, DCM process 52C notifies IC process52B that the interface has been instantiated (76). IC process 52B mayrelay the notification to RP process 52A, which may update routinginformation 40 as well as a respective one of forwarding informationbases 44 to point to the instantiated interface.

Various embodiments of the invention have been described. Althoughpacket-based networks are described herein, other types of data unitsmay also be used consistent with the principles of the invention. Forinstance, the term “packet” is used to generally describe a unit of datacommunicated between resources in conformance with a communicationprotocol. The principles of the invention may be readily applied to avariety of protocols, such as Transmission Control Protocol (TCP), theInternet Protocol (IP), Multi-protocol Label Switch (MPLS), AsynchronousTransfer Mode (ATM), Frame Relay, and the like. Accordingly, “packet” isused to encompass any such unit of data, and may be interchanged withthe term “cell”, or other similar terms used in such protocols todescribe a unit of data communicated between resources within thenetwork. These and other embodiments are within the scope of thefollowing claims.

1. A method comprising: executing a Border Gateway Protocol (BGP)routing protocol on a router; receiving, with the router, BGP routingprotocol packets that specify a route for a virtual private network(VPN); installing the route for the VPN within routing informationwithin the router; selecting one of a plurality of service profileidentifiers for the VPN route; selecting access information associatedwith the service profile for the VPN route; querying an externalauthentication system with the selected access information to obtaininterface parameters for an interface without specifying an individualuser; creating at least one interface within the router based on theinterface parameters obtained from the external service managementsystem; and forwarding data of a data flow associated with the VPN routewith the interface of the router using the interface parameters obtainedfrom the external service management system.
 2. The method of claim 1,wherein the interface parameters comprise interface parameters necessaryfor instantiating an interface to support a specific quality of service(QoS) level.
 3. The method of claim 1, wherein querying the externalauthentication system comprises logging into the external authenticationsystem with the access information.
 4. The method of claim 1, whereinselecting one of the service profile identifiers comprises one of:applying route map logic to compare a BGP community of the BGP routingprotocol packet with the selection criteria to associate the VPN routewith the corresponding service profile identifier, or applying route maplogic to compare a description of a Multiprotocol Label Switching (MPLS)packet with the selection criteria to associate an MPLS path specifiedby the routing information with the corresponding service profileidentifier.
 5. The method of claim 1, wherein the access informationincludes at least one of a username, a password, and a domain associatedwith a service provided by the router without specifying an individualnetwork user.
 6. The method of claim 1, wherein querying the externalauthentication system comprises querying a Remote Authentication Dial-InUser Service (RADIUS) server.
 7. A network device comprising: a controlunit comprising: a microprocessor; a Border Gateway Protocol (BGP)executing on the microprocessor; a routing information base maintainedby the BGP; and a forwarding element having an interface for forwardingpackets, wherein the BGP receives a VPN routing protocol packet from asecond router that includes routing information that specifies a virtualprivate network (VPN) route and installs the route for the VPN withinthe routing information base, wherein, when installing the route, theBGP selects a service profile for the VPN route, determines accessinformation associated with the service profile, queries an externalauthentication system with the selected access information to obtaininterface parameters without specifying an individual user, and whereinthe BGP instructs the forwarding element to configure the interfacebased on the interface parameters obtained from the externalauthentication system and forwards data along the VPN route with theinterface.
 8. The network device of claim 7, wherein the interfaceparameters specify parameters for instantiating an interface to supporta specific quality of service (QoS) level.
 9. The network device ofclaim 7, wherein the BGP queries the external authentication system bylogging into the external authentication system with the accessinformation.